Interesting talk. I should say although hardware keys are effective, websites often fall back to SMS if that’s not available, essentially defeating the purpose of hardware key.
Regarding security keys, actually it depends: if you are enrolled in advanced protection no you must have two security keys and we don't fall back. For normal users that is the case yes. Until phone as a security keys is widely used and security keys are main stream the no fall back option can't be the default but hopefully we get there :)
2 comments
[ 3.0 ms ] story [ 12.7 ms ] threadIsn’t that the case with Google account also?
Regarding security keys, actually it depends: if you are enrolled in advanced protection no you must have two security keys and we don't fall back. For normal users that is the case yes. Until phone as a security keys is widely used and security keys are main stream the no fall back option can't be the default but hopefully we get there :)